CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file

MEDIO 5.0CVE-2011-3712 · GHSA-r7p6-fr3x-r877 · Published 23/09/2011 · updated 16/06/2026

Package	Affected versions	Patched versions
cakephp/cakephp Packagist	`≥ 1.3.7, < 1.3.8`	`1.3.8`
cakephp cakephp	`= 1.3.7`	No fix yet

Description

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.

NVD description

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.

References

nvd.nist.gov/vuln/detail/CVE-2011-3712 · ADVISORY
cakephp/cakephp · PACKAGE
code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README · WEB
code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cakephp-1.3.7 · WEB
openwall.com/lists/oss-security/2011/06/27/6 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free